From 73f5e83614e6602a14e9e72d1d232d0e5033ba46 Mon Sep 17 00:00:00 2001 From: Tomaz Zaman Date: Sun, 16 Aug 2026 04:14:14 +0200 Subject: [PATCH 63/72] layerscape: mono_gateway-dk: add u-blox JODY-W3 (NXP 88W9098) Wi-Fi MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PCIe Wi-Fi 6 via the NXP out-of-tree moal/mlan driver (cfg80211 fullmac); LuCI/mac80211.sh manage it natively — no custom netifd handler. - package/kernel/nxp-mwifiex: kmod (mlan+moal) vs OpenWrt backports cfg80211; patch 010 pins COMPAT_VERSION_CODE to backports 6.18.26. PCIe-9098 only; deps kmod-cfg80211 + the firmware pkg. - package/firmware/nxp-wifi-firmware: 9098 PCIe firmware, git-fetched from imx-firmware lf-6.12.49_2.2.0 (FwImage_9098_PCIE) -> /lib/firmware/nxp. - configs/mono_gateway-dk.seed: kmod-nxp-mwifiex + firmware + wpad-openssl (not -basic: can't parse VHT/HE hostapd config) + iw. - selinux-policy/stockfixes.cil: close the permissive AVCs the above surface — wpa.server reads openssl.conftmp (hostapd links libssl), rpc.server reads firmware.data (find stats regulatory.db). HW-validated on the DUT: both MACs probe, firmware loads, AP-ENABLED, bridges to LAN. No-op on a board with no card (same image ships to both units). Co-Authored-By: Claude Opus 4.8 --- configs/mono_gateway-dk.seed | 13 +++ package/firmware/nxp-wifi-firmware/Makefile | 48 ++++++++++ package/kernel/nxp-mwifiex/Makefile | 93 +++++++++++++++++++ ...0-openwrt-backports-cfg80211-version.patch | 31 +++++++ .../selinux-policy/files/cil/stockfixes.cil | 9 ++ 5 files changed, 194 insertions(+) create mode 100644 package/firmware/nxp-wifi-firmware/Makefile create mode 100644 package/kernel/nxp-mwifiex/Makefile create mode 100644 package/kernel/nxp-mwifiex/patches/010-openwrt-backports-cfg80211-version.patch diff --git a/configs/mono_gateway-dk.seed b/configs/mono_gateway-dk.seed index c72858337d..978635fe83 100644 --- a/configs/mono_gateway-dk.seed +++ b/configs/mono_gateway-dk.seed @@ -79,6 +79,19 @@ CONFIG_PACKAGE_auditd=y # capabilities profile. Will need its own SELinux domain later (author from soak). CONFIG_PACKAGE_adguardhome=y +# Wi-Fi: u-blox JODY-W3 = NXP 88W9098 (Wi-Fi 6), PCIe, dual-MAC. Out-of-tree NXP +# moal/mlan driver (kmod-nxp-mwifiex — a cfg80211 FULLMAC driver; needs the +# backports-version patch carried in package/kernel/nxp-mwifiex) + its firmware pkg. +# Full wpad-openssl, NOT wpad-basic: basic hostapd can't parse VHT(ac)/HE(ax) +# config items and fails add_iface on anything above 802.11n. iw for debugging. +# defconfig pulls the rest (kmod-cfg80211, wifi-scripts, wireless-regdb, +# hostapd-common, ucode-mod-nl80211). LuCI manages the radios natively via +# mac80211.sh (no custom handler); harmless no-op on a board with no M.2 card. +CONFIG_PACKAGE_kmod-nxp-mwifiex=y +CONFIG_PACKAGE_nxp-wifi-firmware-9098-pcie=y +CONFIG_PACKAGE_wpad-openssl=y +CONFIG_PACKAGE_iw=y + # Drop LuCI's Software (apk) WEB frontend only. It made the cgi-io helper exec apk, # dragging a large SELinux AVC surface (apk data/conf/cache reads + exec) into the # web path, and web-driven package management isn't our delivery model (sysupgrade diff --git a/package/firmware/nxp-wifi-firmware/Makefile b/package/firmware/nxp-wifi-firmware/Makefile new file mode 100644 index 0000000000..b7812b3b7a --- /dev/null +++ b/package/firmware/nxp-wifi-firmware/Makefile @@ -0,0 +1,48 @@ +# +# NXP 88W9098 PCIe Wi-Fi firmware (u-blox JODY-W3) +# +# Fetched from nxp-imx/imx-firmware (tag lf-6.12.49_2.2.0), dir FwImage_9098_PCIE, +# installed to /lib/firmware/nxp/ where the nxp-mwifiex (moal) driver loads it. +# +include $(TOPDIR)/rules.mk + +PKG_NAME:=nxp-wifi-firmware +PKG_VERSION:=6.12.49 +PKG_RELEASE:=1 + +PKG_SOURCE_PROTO:=git +PKG_SOURCE_URL:=https://github.com/nxp-imx/imx-firmware.git +PKG_SOURCE_DATE:=2026-08-15 +PKG_SOURCE_VERSION:=8c9b278016c97527b285f2fcbe53c2d428eb171d +PKG_MIRROR_HASH:=skip + +include $(INCLUDE_DIR)/package.mk + +define Package/nxp-wifi-firmware-9098-pcie + SECTION:=firmware + CATEGORY:=Firmware + TITLE:=NXP 88W9098 PCIe Wi-Fi firmware (JODY-W3) + URL:=https://github.com/nxp-imx/imx-firmware +endef + +define Package/nxp-wifi-firmware-9098-pcie/description + NXP 88W9098 PCIe firmware + regulatory/TX-power config for the u-blox JODY-W3, + from imx-firmware lf-6.12.49_2.2.0 (FwImage_9098_PCIE). Loaded by the + nxp-mwifiex (moal) driver from /lib/firmware/nxp/. +endef + +define Build/Compile +endef + +FW9098:=$(PKG_BUILD_DIR)/FwImage_9098_PCIE + +define Package/nxp-wifi-firmware-9098-pcie/install + $(INSTALL_DIR) $(1)/lib/firmware/nxp + $(INSTALL_DATA) $(FW9098)/pcieuart9098_combo_v1.bin $(1)/lib/firmware/nxp/ + $(INSTALL_DATA) $(FW9098)/pcie9098_wlan_v1.bin $(1)/lib/firmware/nxp/ + $(INSTALL_DATA) $(FW9098)/uart9098_bt_v1.bin $(1)/lib/firmware/nxp/ + $(INSTALL_DATA) $(FW9098)/ed_mac_ctrl_V3_909x.conf $(1)/lib/firmware/nxp/ + $(INSTALL_DATA) $(FW9098)/txpwrlimit_cfg_9098.conf $(1)/lib/firmware/nxp/ +endef + +$(eval $(call BuildPackage,nxp-wifi-firmware-9098-pcie)) diff --git a/package/kernel/nxp-mwifiex/Makefile b/package/kernel/nxp-mwifiex/Makefile new file mode 100644 index 0000000000..0cbb634783 --- /dev/null +++ b/package/kernel/nxp-mwifiex/Makefile @@ -0,0 +1,93 @@ +# +# NXP MXM Wi-Fi driver (moal + mlan) for the 88W9098 (u-blox JODY-W3), PCIe. +# +# Source: nxp-imx/mwifiex, branch hotfix/lf-6.12.49_2.2.0_hotfix. +# It is a cfg80211 FULLMAC driver (not mac80211) -> built against OpenWrt's +# backports headers/symbols (the mac80211 package). Drive AP with hostapd. +# +include $(TOPDIR)/rules.mk +include $(INCLUDE_DIR)/kernel.mk + +PKG_NAME:=nxp-mwifiex +PKG_RELEASE:=1 + +PKG_SOURCE_PROTO:=git +PKG_SOURCE_URL:=https://github.com/nxp-imx/mwifiex.git +PKG_SOURCE_DATE:=2026-08-15 +PKG_SOURCE_VERSION:=09f41e1423e4806a127507d5fa284cd02c46772f +PKG_MIRROR_HASH:=skip + +PKG_BUILD_DEPENDS:=mac80211 +PKG_BUILD_PARALLEL:=1 + +include $(INCLUDE_DIR)/package.mk + +define KernelPackage/nxp-mwifiex + SECTION:=kernel + CATEGORY:=Kernel modules + SUBMENU:=Wireless Drivers + TITLE:=NXP 88W9098 (moal/mlan) PCIe Wi-Fi driver + URL:=https://github.com/nxp-imx/mwifiex + DEPENDS:=@PCI_SUPPORT +kmod-cfg80211 +nxp-wifi-firmware-9098-pcie + FILES:= \ + $(PKG_BUILD_DIR)/mlan.ko \ + $(PKG_BUILD_DIR)/moal.ko + AUTOLOAD:=$(call AutoProbe,mlan moal) +endef + +define KernelPackage/nxp-mwifiex/description + NXP MXM Wi-Fi driver (moal + mlan) for the 88W9098 (u-blox JODY-W3) over PCIe. + cfg80211 fullmac; drive the AP with hostapd over nl80211. +endef + +# Prepend OpenWrt's backports cfg80211 headers so they win over the in-kernel +# ones, and force-include backport/backport.h (defines CPTCFG_CFG80211 etc.). +# Order mirrors backports' own Makefile.kernel: backport-include first, then +# the refreshed subsystem headers (include/), each with its uapi/ sibling. +BACKPORT_INC:= \ + -I$(STAGING_DIR)/usr/include/mac80211-backport \ + -I$(STAGING_DIR)/usr/include/mac80211-backport/uapi \ + -I$(STAGING_DIR)/usr/include/mac80211 \ + -I$(STAGING_DIR)/usr/include/mac80211/uapi \ + -include backport/backport.h + +# Build only the PCIe-9098 chip; drop every SDIO/USB/other-PCIe variant. +NXP_CHIP_FLAGS:= \ + CONFIG_PCIE9098=y \ + CONFIG_SD8978=n CONFIG_SD8987=n CONFIG_SD9177=n CONFIG_SD9098=n \ + CONFIG_SDIW610=n CONFIG_USBIW610=n CONFIG_SDAW693=n CONFIG_PCIEAW693=n \ + CONFIG_PCIE9097=n CONFIG_PCIE8897=n + +# cfg80211 FULLMAC only. Force the driver's STA/uAP cfg80211 knobs on and its +# legacy WEXT knobs off, bypassing the upstream Makefile's CPTCFG/CONFIG_CFG80211 +# autodetection (which reads CPP macros as make vars and has a copy-paste bug in +# the uAP branch). Command-line vars can't be overridden by the driver Makefile. +NXP_FEATURE_FLAGS:= \ + CONFIG_NXP_WLAN_DRIVER=m \ + CONFIG_OPENWRT_SUPPORT=y \ + CONFIG_STA_SUPPORT=y \ + CONFIG_UAP_SUPPORT=y \ + CONFIG_STA_CFG80211=y \ + CONFIG_UAP_CFG80211=y \ + CONFIG_STA_WEXT=n \ + CONFIG_UAP_WEXT=n + +# The driver Makefile builds obj-m := mlan.o + moal.o under the kernel Kbuild. +# KERNEL_MAKEOPTS already supplies -C $(LINUX_DIR), the cross toolchain and +# KBUILD_EXTRA_SYMBOLS (=$(KERNEL_BUILD_DIR)/symvers/*.symvers, i.e. cfg80211's +# exports from the mac80211 package). We cd into the module dir first so the +# driver's own "-I$(PWD)/mlan" resolves there ("-C" moves CURDIR, not $(PWD)), +# and inject the backports headers via NOSTDINC_FLAGS so they precede +# LINUXINCLUDE (the exact slot backports uses). +define Build/Compile + +cd $(PKG_BUILD_DIR) && \ + $(MAKE) $(PKG_JOBS) $(KERNEL_MAKEOPTS) \ + M=$(PKG_BUILD_DIR) \ + KERNELDIR=$(LINUX_DIR) \ + NOSTDINC_FLAGS="$(BACKPORT_INC) -nostdinc" \ + $(NXP_FEATURE_FLAGS) \ + $(NXP_CHIP_FLAGS) \ + modules +endef + +$(eval $(call KernelPackage,nxp-mwifiex)) diff --git a/package/kernel/nxp-mwifiex/patches/010-openwrt-backports-cfg80211-version.patch b/package/kernel/nxp-mwifiex/patches/010-openwrt-backports-cfg80211-version.patch new file mode 100644 index 0000000000..5011b9bf14 --- /dev/null +++ b/package/kernel/nxp-mwifiex/patches/010-openwrt-backports-cfg80211-version.patch @@ -0,0 +1,31 @@ +Build against OpenWrt's backports cfg80211 API, not the running kernel's. + +This driver picks its cfg80211 code paths from CFG80211_VERSION_CODE, which +is MAX(LINUX_VERSION_CODE, COMPAT_VERSION_CODE). Out of the box +COMPAT_VERSION_CODE is KERNEL_VERSION(0,0,0), so the effective version equals +the running kernel (6.12.49). But on OpenWrt cfg80211 comes from the mac80211 +*backports* package, whose API is much newer than the kernel it runs on -- +here backports v6.18.26 (BACKPORTED_KERNEL_VERSION). The driver already carries +the matching newer code paths (guards up to KERNEL_VERSION(6,17,0)/(6,18,0)), +they just aren't selected, so struct cfg80211_ops initialisers (get/set_antenna +gained a radio_idx, set_monitor_channel gained a net_device*, get/set_txpower +gained radio_idx, ...) mismatch the backports prototypes and GCC 14 rejects +them as -Wincompatible-pointer-types errors. + +Pin COMPAT_VERSION_CODE to the backports API version so every version guard +resolves against the headers we actually compile against. + +NOTE: keep this in sync with package/kernel/mac80211 PKG_VERSION. If that +backports version is bumped, update the KERNEL_VERSION() below to match. + +--- a/mlinux/moal_main.h ++++ b/mlinux/moal_main.h +@@ -190,7 +190,7 @@ + #define MAX(a, b) ((a) > (b) ? (a) : (b)) + #endif + +-#define COMPAT_VERSION_CODE KERNEL_VERSION(0, 0, 0) ++#define COMPAT_VERSION_CODE KERNEL_VERSION(6, 18, 26) + #define CFG80211_VERSION_CODE MAX(LINUX_VERSION_CODE, COMPAT_VERSION_CODE) + + #define IMX_ANDROID_13 0 diff --git a/package/system/selinux-policy/files/cil/stockfixes.cil b/package/system/selinux-policy/files/cil/stockfixes.cil index f65ebc5592..c2b8392082 100644 --- a/package/system/selinux-policy/files/cil/stockfixes.cil +++ b/package/system/selinux-policy/files/cil/stockfixes.cil @@ -228,6 +228,7 @@ ;; rpcd-native system-state reads (not attributable to a confined helper) (call .firmware.data.list_file_dirs (subj)) + (call .firmware.data.read_file_files (subj)) ;; getattr /lib/firmware/regulatory.db (wireless-regdb, Wi-Fi) (call .preinit.data.list_file_dirs (subj)) (call .preinit.data.read_file_files (subj)) (call .netif.data.list_file_dirs (subj)) @@ -471,3 +472,11 @@ (in netif.server (allow subj self create_tcp_socket)) + +;; hostapd built with OpenSSL (wpad-openssl — needed for the JODY-W3/9098 Wi-Fi +;; VHT/HE APs; wpad-basic can't parse VHT/HE hostapd config items) links libssl, +;; which reads its provider/engine config under /tmp/etc/ssl (openssl.conftmp) at +;; startup: search the dir + getattr/open/read providers.cnf/engines.cnf. +(in wpa.server + (call .openssl.conftmp.search_file_dirs (subj)) + (call .openssl.conftmp.read_file_files (subj))) -- 2.47.3